The CanUpgrade role is never used for sorting. UpdatesPage does not use ResourcesProxyModel for the list of updates either.